rgw: allow system users to read SLO parts

multisite data sync relies on fetching the object as the system user

Fixes: http://tracker.ceph.com/issues/19027
Signed-off-by: Casey Bodley <cbodley@redhat.com>
(cherry picked from commit d50d18c500fd5dd89e7cada1162cf453b36df370)

diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc
index 240d41cd4757d0efd1a0cff7013004e9a2c6d9de..299c3de72a4f37eb7877f8d0da702c34c5092de8 100644 (file)
--- a/src/rgw/rgw_op.cc
+++ b/src/rgw/rgw_op.cc
@@ -849,8 +849,12 @@ int RGWGetObj::read_user_manifest_part(rgw_bucket& bucket,
 
   /* We can use global user_acl because LOs cannot have segments
    * stored inside different accounts. */
-  if (!verify_object_permission(s, s->user_acl.get(), bucket_policy,
-          &obj_policy, RGW_PERM_READ)) {
+  if (s->system_request) {
+    ldout(s->cct, 2) << "overriding permissions due to system operation" << dendl;
+  } else if (s->auth_identity->is_admin_of(s->user->user_id)) {
+    ldout(s->cct, 2) << "overriding permissions due to admin operation" << dendl;
+  } else if (!verify_object_permission(s, s->user_acl.get(), bucket_policy,
+                                       &obj_policy, RGW_PERM_READ)) {
     return -EPERM;
   }